CVE-2025-43844

Name of the Vulnerable Software and Affected Versions Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior

Description Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The variables exp dir1, among others, take user input and pass it to the click train function, which concatenates them into a command that is run on the server. This can lead to arbitrary command execution. As of the time of publication, no known patches exist.

Recommendations For versions 2.2.231006 and prior, as a temporary workaround, consider restricting the input to the exp dir1 variable and other similar variables to prevent malicious commands from being executed. Additionally, restrict access to the click train function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.